https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102706
Martin Sebor <msebor at gcc dot gnu.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |crazylht at gmail dot com Keywords| |diagnostic Status|UNCONFIRMED |NEW Ever confirmed|0 |1 Blocks| |56456 Last reconfirmed| |2021-10-12 --- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> --- Confirmed. The root cause is similar as in the test case in pr102462 comment 4. Here, in addition to the expected -Warray-bounds (from the vrp1 pass) for the invalid subscripts (before vectorization) the code also triggers -Wstringop-overflow (from the strlen pass) for the two valid stores to p->ax at indices 0 and 1 vectorized with the subsequent two stores. See the dumps below. Hongtao and I have been discussing the fallout of the autovectorization change in the context of the following review: https://gcc.gnu.org/pipermail/gcc-patches/2021-October/581371.html Hongtao, we could use this bug to track case (2) that you described in your reply this morning in the thread above. $ cat pr102706.c && /build/iq2000-elf/gcc-master/gcc/xgcc -B /build/iq200f/gcc-master/gcc -O2 -S -Wall -fdump-tree-vrp1=/dev/stdout -fdump-tree-strlen=/dev/stdout pr102706.c typedef __INT16_TYPE__ int16_t; typedef __INT32_TYPE__ int32_t; void sink (void*); /* Exercise a true flexible member. */ struct AX { int32_t n; int16_t ax[]; // { dg-message "while referencing 'ax'" "member" } }; static void warn_ax_local_buf (struct AX *p) { p->ax[0] = 4; p->ax[1] = 5; p->ax[2] = 6; // { dg-warning "\\\[-Warray-bounds" } p->ax[3] = 7; // { dg-warning "\\\[-Warray-bounds" } p->ax[4] = 8; // { dg-warning "\\\[-Warray-bounds" } } void g (void) { /* Verify out-of-bounds access to the local BUF is diagnosed. */ char ax_buf_p2[sizeof (struct AX) + 2 * sizeof (int16_t)]; warn_ax_local_buf ((struct AX*) ax_buf_p2); sink (ax_buf_p2); } ;; Function g (g, funcdef_no=1, decl_uid=1438, cgraph_uid=2, symbol_order=1) ;; 1 loops found ;; ;; Loop 0 ;; header 0, latch 1 ;; depth 0, outer -1 ;; nodes: 0 1 2 ;; 2 succs { 1 } Value ranges after VRP: In function 'warn_ax_local_buf', inlined from 'g' at pr102706.c:28:3: pr102706.c:18:8: warning: array subscript 2 is above array bounds of 'int16_t[]' {aka 'short int[]'} [-Warray-bounds] 18 | p->ax[2] = 6; // { dg-warning "\\\[-Warray-bounds" } | ~~~~~^~~ pr102706.c: In function 'g': pr102706.c:11:11: note: while referencing 'ax' 11 | int16_t ax[]; // { dg-message "while referencing 'ax'" "member" } | ^~ In function 'warn_ax_local_buf', inlined from 'g' at pr102706.c:28:3: pr102706.c:19:8: warning: array subscript 3 is above array bounds of 'int16_t[]' {aka 'short int[]'} [-Warray-bounds] 19 | p->ax[3] = 7; // { dg-warning "\\\[-Warray-bounds" } | ~~~~~^~~ pr102706.c: In function 'g': pr102706.c:11:11: note: while referencing 'ax' 11 | int16_t ax[]; // { dg-message "while referencing 'ax'" "member" } | ^~ In function 'warn_ax_local_buf', inlined from 'g' at pr102706.c:28:3: pr102706.c:20:8: warning: array subscript 4 is above array bounds of 'int16_t[]' {aka 'short int[]'} [-Warray-bounds] 20 | p->ax[4] = 8; // { dg-warning "\\\[-Warray-bounds" } | ~~~~~^~~ pr102706.c: In function 'g': pr102706.c:11:11: note: while referencing 'ax' 11 | int16_t ax[]; // { dg-message "while referencing 'ax'" "member" } | ^~ void g () { char ax_buf_p2[8]; <bb 2> [local count: 1073741824]: MEM[(struct AX *)&ax_buf_p2].ax[0] = 4; MEM[(struct AX *)&ax_buf_p2].ax[1] = 5; MEM[(struct AX *)&ax_buf_p2].ax[2] = 6; MEM[(struct AX *)&ax_buf_p2].ax[3] = 7; MEM[(struct AX *)&ax_buf_p2].ax[4] = 8; sink (&ax_buf_p2); ax_buf_p2 ={v} {CLOBBER}; return; } ;; Function g (g, funcdef_no=1, decl_uid=1438, cgraph_uid=2, symbol_order=1) ;; 1 loops found ;; ;; Loop 0 ;; header 0, latch 1 ;; depth 0, outer -1 ;; nodes: 0 1 2 ;; 2 succs { 1 } In function 'warn_ax_local_buf', inlined from 'g' at pr102706.c:28:3: pr102706.c:16:12: warning: writing 4 bytes into a region of size 0 [-Wstringop-overflow=] 16 | p->ax[0] = 4; p->ax[1] = 5; | ~~~~~~~~~^~~ pr102706.c: In function 'g': pr102706.c:27:8: note: at offset 8 into destination object 'ax_buf_p2' of size 8 27 | char ax_buf_p2[sizeof (struct AX) + 2 * sizeof (int16_t)]; | ^~~~~~~~~ void g () { int16_t * vectp.5; vector(2) short int * vectp_ax_buf_p2.4; char ax_buf_p2[8]; <bb 2> [local count: 1073741824]: MEM <vector(2) short int> [(short int *)&ax_buf_p2 + 4B] = { 4, 5 }; MEM <vector(2) short int> [(short int *)&ax_buf_p2 + 8B] = { 6, 7 }; MEM[(struct AX *)&ax_buf_p2].ax[4] = 8; sink (&ax_buf_p2); ax_buf_p2 ={v} {CLOBBER}; return; } Referenced Bugs: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56456 [Bug 56456] [meta-bug] bogus/missing -Warray-bounds